Module keys_cli 

lean-ctx gateway keys (enterprise#48) — per-person key management for gateway-keys.toml, replacing the manual openssl rand | shasum dance.

Storage rule is unchanged (enterprise#11): the file holds only SHA-256 hashes; the plaintext key is printed exactly once at creation and never touches disk. Writes are atomic (temp file + rename) so a concurrent gateway restart never sees a half-written key set.

Structs

KeyListEntry

A parsed identity row for list (no hash material beyond a short prefix).

RotatedKey

The result of a key rotation: the fresh plaintext key plus the identity it kept and how many old entries it replaced.

Functions

add_key

Appends a [[keys]] entry. Preserves existing content (comments included) by appending; refuses a duplicate person unless allow_multiple.

generate_key

Generates a new bearer key: gk-<person-slug>-<48 hex chars>.

list_keys

Lists identities (person/team/project + hash prefix), file order.

revoke_keys

Removes all keys of person (rewrites the file). Returns how many entries were removed.

rotate_key

Rotates person’s key (enterprise#67): mints a fresh key, drops every old entry of that person and writes the replacement in one atomic swap — there is no intermediate state where the person has zero valid keys on disk. Team and default project carry over from the person’s first entry.

write_empty

Creates a valid, empty key file (deploy mounts require the file to exist).